fa7c8ea6e65a3a50ebbbab4853c51569864dba79af48cbf4929a46fcc58361cf

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29-04-2024 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-29_1ad6fd486496a118cc4c9b6ca797edf6_cryptolocker.exe
Size

51KB
MD5

1ad6fd486496a118cc4c9b6ca797edf6
SHA1

06a0ed0bcfda4087fed09790dd0a686ed58d55c9
SHA256

fa7c8ea6e65a3a50ebbbab4853c51569864dba79af48cbf4929a46fcc58361cf
SHA512

9157675dad5ab8387490de19f69e81c805c0e1ccf01b8e27942a97f03880b0924e37ebee063638c1d2d3fdd8cbc73f4cbb5675f9cf27f4c970ccfe6fcc47b312
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzpAI4r:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7/

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023298-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023298-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	2024-04-29_1ad6fd486496a118cc4c9b6ca797edf6_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

pid	Process
816	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 816	3652	2024-04-29_1ad6fd486496a118cc4c9b6ca797edf6_cryptolocker.exe	83
PID 3652 wrote to memory of 816	3652	2024-04-29_1ad6fd486496a118cc4c9b6ca797edf6_cryptolocker.exe	83
PID 3652 wrote to memory of 816	3652	2024-04-29_1ad6fd486496a118cc4c9b6ca797edf6_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-04-29_1ad6fd486496a118cc4c9b6ca797edf6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-29_1ad6fd486496a118cc4c9b6ca797edf6_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
52KB

MD5
a619b7b3314854c68cb41415eba27f46

SHA1
06dea50727d365b2c7655bd85aea838420da212c

SHA256
4100f90c539e4faf3ea1c67cc527f3e4fbf53dd0ddf80a2a72db872653bce4cc

SHA512
bfd1bc8580c61e482f503259c8b92b4829658c3ad662e211d2b7b63b33a7b2203467c56cffd0cbad11c262bfbe5fa570e8de082fea471a57bdc9d2033218a633

Download Submit
memory/816-25-0x00000000020C0000-0x00000000020C6000-memory.dmp

Filesize
24KB

Download
memory/3652-0-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download
memory/3652-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3652-8-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download